Citrix patches 28 NetScaler flaws, including critical default-config bug
Citrix's November 12 update fixes memory flaws in NetScaler ADC and Gateway; the most severe, CVE-2026-120868, scores 9.3 under CVSS 4.0.
Citrix released a security update on November 12 that fixes 28 memory vulnerabilities in NetScaler ADC and NetScaler Gateway, according to dailysecu.com. One of the flaws affects appliances in their default configuration.
The most serious issue, tracked as CVE-2026-120868, carries a CVSS 4.0 score of 9.3. It is a memory flaw that arises during network packet processing and can be exploited without logging in, and it does not require any additional feature to be enabled. Exploitation could cause abnormal behaviour or service disruption.
A second flaw, CVE-2026-107412, has a CVSS score of 9.5 and affects appliances configured with gateway features such as SSL VPN or AAA virtual servers.
Versions to install
The regular edition must be updated to version 13.1-64.39 or 14.1-73.57 or later, according to the advisory.
The EU cyber security incident response team recommended the update the same day. The published advisory did not confirm any actual exploitation of the vulnerabilities.
Quick answers
Which NetScaler ADC and Gateway versions fix the vulnerabilities?
The regular edition must be updated to 13.1-64.39 or 14.1-73.57 or later.
How severe is CVE-2026-120868?
It has a CVSS 4.0 score of 9.3 and can be exploited on default configurations without logging in, potentially causing abnormal behaviour or service disruption.
Have the flaws been exploited in the wild?
No actual exploitation was confirmed in the published advisory.